General
-
Target
58cde13b538a2d4760833ae15e9acb8f2cd544dd1738280b7528a7a057222943.bin
-
Size
409KB
-
Sample
230501-acc4ysde9z
-
MD5
db74f149f85fd1ea4f1286a75d5a9d1e
-
SHA1
9b04514fb29c4cdcea7d3378074b407bfe222158
-
SHA256
58cde13b538a2d4760833ae15e9acb8f2cd544dd1738280b7528a7a057222943
-
SHA512
759ad9ce0ff6688948a991a3ddcf58b2c42e6cba9c0e0229562e845241cb94d586c40dc099883af086e5191e38807f647e9585b79ecb7f75e728e4132eb5d883
-
SSDEEP
6144:mJK8sjgF94p3npp+oaj7AlPX/wyo3r3/H8Xt9ycN6ydNh+1:8KHEvsnz+o47AZO/c99PdN
Static task
static1
Behavioral task
behavioral1
Sample
58cde13b538a2d4760833ae15e9acb8f2cd544dd1738280b7528a7a057222943.exe
Resource
win7-20230220-en
Malware Config
Extracted
vidar
3.6
78489afd9d9a4747beb445e5fb5b9c96
https://steamcommunity.com/profiles/76561199499188534
https://t.me/nutalse
-
profile_id_v2
78489afd9d9a4747beb445e5fb5b9c96
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
Extracted
laplas
http://89.23.97.128
-
api_key
bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396
Targets
-
-
Target
58cde13b538a2d4760833ae15e9acb8f2cd544dd1738280b7528a7a057222943.bin
-
Size
409KB
-
MD5
db74f149f85fd1ea4f1286a75d5a9d1e
-
SHA1
9b04514fb29c4cdcea7d3378074b407bfe222158
-
SHA256
58cde13b538a2d4760833ae15e9acb8f2cd544dd1738280b7528a7a057222943
-
SHA512
759ad9ce0ff6688948a991a3ddcf58b2c42e6cba9c0e0229562e845241cb94d586c40dc099883af086e5191e38807f647e9585b79ecb7f75e728e4132eb5d883
-
SSDEEP
6144:mJK8sjgF94p3npp+oaj7AlPX/wyo3r3/H8Xt9ycN6ydNh+1:8KHEvsnz+o47AZO/c99PdN
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-